Embed Size (px)
Citation preview
Viant Capital
San Francisco
October 2018
Cyber Security Industry Trends
About Viant CapitalViant Capital, a FINRA-registered broker-dealer, is
chartered to engage in all investment banking activities.
Based in San Francisco, Viant’s seasoned industry
professionals provide advisory services to a global base of
SaaS and technology clients. Viant Capital has deep
industry knowledge, a strong track record of delivering
optimal outcomes, and significant relationships with
software and private equity firms actively seeking to invest
within the Technology marketplace.
Cyber Security deal activity high with a large
amount of strategically motivated transactions.
The global cyber security market was estimated to be worth over $120
billion as of 2017. The market grew by approximately 35 times since
2004 and is projected to grow at 9%-10% year-over-year through 2021.
Growth is projected to be driven by rises in cybercrime, vulnerability of
IT and communication networks, specifically billions of Internet of
Things (IoT) devices, and ransomware threats.
Cyber Security M&A market activity is high. As of Q3 2018, 139
M&A transactions were completed. Active subsectors included Cyber
Security Consulting and Access Management.
Strategic acquirers in particular have been very active, indicating a
drive towards consolidation in the industry. A few examples of
strategically motivated acquisitions this year include Cisco acquiring Duo
Security, PayPal acquiring Simility, Splunk acquiring VictorOps and
McAfee acquiring TunnelBear. Buyers have been driven by the need to
acquire complementary technology and to expand into new spaces (and
prevent competitors from acquiring such technology).
Private Equity (PE) and PE backed strategic buyers have also
been active in the cyber security space. PE firms are often
attempting to consolidate smaller cybersecurity companies operating in
the same vertical through strategic acquisitions to drive growth and gain
market share. Some large active players in this group include Vista
Equity Partners, Thoma Bravo, Bain Capital and BlackRock.
Market conditions are providing traction for Cyber Security
investments. Cyber threats are becoming the number one risk to
businesses. Increased risk and insufficient governance in the space
combined with the rapid development of “targets”, such as cloud and
IoT, legacy companies are still trying to catch up with increased
vulnerabilities. This gap is being filled by smaller, modern players. This
could continue to present a chance for increased investments in cyber
security.
Source: Wall Street Research
BRIEF CONTENTS
▪ Market Valuation ▪ Financing Activity
▪ M&A Environment ▪ Industry Perspective
Scott Smith
CEO and Managing Director
(415) 710-0079
Kendra Boyle
Associate
(248) 819-0550
Ashwin Sundaresan
Analyst
(415) 820-6103
1
178
139
2017 YTD Q3 2018
Cyber Security M&A Deal Volume
Source: Cisco Security Report, Cyber Security Ventures, Wall Street Research
Viant Capital
San Francisco
Table of Contents
Global Market Valuation
M&A Activity
Financing Activity
Industry Perspectives
3
4
6
7
2
Viant Capital
San Francisco
Global Market Valuation
Market Data as of October 1, 2018
Source: CapitalIQ, Company Filings3
Valuation Multiples
(USD$ in millions) Valuation LTM Financials Rev Growth
High Growth Cybersecurity Mkt Cap TEV Revenue EBITDA CY15-CY17 CY17-CY18E LTM CY2018 LTM CY2018
Everbridge, Inc. $1,665.6 $1,651.8 $134.4 ($33.2) 33.3% 40.0% 12.3x 11.3x NM NM
ForeScout Technologies, Inc. $1,530.0 $1,329.4 $272.3 ($93.4) 32.4% 31.5% 4.9x 4.6x NM NM
Mimecast Limited $2,423.0 $2,346.4 $301.2 $19.5 33.2% 32.3% 7.8x 7.4x NM 54.3x
Okta, Inc. $7,841.5 $7,569.0 $325.6 ($120.5) 74.0% 44.3% 23.2x 20.2x NM NM
Palo Alto Networks, Inc. $21,092.3 $19,609.0 $2,273.1 $6.5 31.5% 27.0% 8.6x 7.8x NM 28.6x
Proofpoint, Inc. $5,352.9 $5,422.9 $661.0 ($38.9) 39.3% 38.0% 8.2x 7.6x NM 50.7x
SailPoint Technologies Holdings $2,912.5 $2,840.3 $238.5 $19.5 39.7% 29.9% 11.9x 11.7x NM NM
Splunk Inc. $17,237.3 $16,414.3 $1,463.7 ($243.1) 37.9% 32.9% 11.2x 9.7x NM NM
Zscaler, Inc. $4,782.5 $4,484.0 $190.2 ($19.5) N/A 46.1% 23.6x 19.9x NM NM
Mean 12.4x 11.1x NM 44.6x
Median 9.9x 8.7x NM 50.7x
Low Growth Cybersecurity
Check Point Software Technologies $18,391.0 $16,709.2 $1,896.9 $309.6 6.7% 2.9% 8.8x 8.8x NM 16.2x
CyberArk Software Ltd. $2,777.8 $2,420.8 $314.5 $41.5 27.6% 26.1% 7.7x 7.3x NM 27.3x
F5 Networks, Inc. $11,609.0 $10,524.5 $2,161.4 $661.4 3.8% 4.2% 4.9x 4.8x 15.9x 12.4x
FireEye, Inc. $3,233.2 $3,097.3 $790.7 ($127.7) 9.8% 10.5% 3.9x 3.7x NM 27.0x
Fortinet, Inc. $15,609.6 $14,175.9 $1,710.8 $245.2 21.7% 19.7% 8.3x 7.9x NM 31.9x
F-Secure Oyj $558.7 $466.3 $210.6 $12.9 12.7% 5.6% 2.2x 2.2x 36.3x 33.0x
Imperva, Inc. $1,582.8 $1,188.3 $351.8 $5.0 17.2% 9.7% 3.4x 3.4x NM 26.6x
OneSpan Inc. $758.2 $656.8 $202.0 $2.8 (10.5%) 7.1% 3.3x 3.2x NM 39.9x
Qualys, Inc. $3,355.7 $3,033.2 $267.6 $75.8 18.5% 20.8% 11.3x 10.9x 40.0x 27.2x
Rapid7, Inc. $1,699.0 $1,584.2 $233.1 ($44.8) 34.8% 20.4% 6.8x 6.5x NM NM
SecureWorks Corp. $1,138.6 $1,036.4 $492.9 ($37.9) 17.4% 11.0% 2.1x 2.0x NM NM
Sophos Group plc $3,101.7 $3,274.8 $693.4 $39.1 13.2% 17.6% 4.7x 4.6x NM 37.3x
Symantec Corporation $12,921.8 $15,628.8 $4,750.0 $966.0 14.3% 0.4% 3.3x 3.3x 16.2x 7.3x
Trend Micro Incorporated $9,115.4 $7,850.3 $1,401.1 $455.3 13.0% 8.3% 5.6x 5.5x 17.2x 15.9x
Mean 5.4x 5.3x 25.1x 25.2x
Median 4.8x 4.7x 17.2x 27.1x
Overall Mean 8.0x 7.4x 25.1x 29.0x
Overall Median 7.2x 6.9x 17.2x 27.3x
TEV/Revenue TEV/EBITDA
Viant Capital
San Francisco
M&A Activity – YTD Q3 2018
Source: CapitalIQ, Momentum Cyber 4
Five Year M&A Deal Activity By Quarter
As of YTD Q3 2018, both M&A deal volume and M&A deal value have increased as compared to YTD Q3
2017. From YTD Q3 2017 to YTD Q3 2018, deal activity increased from 133 to 139 and deal volume increased
from $8.9 billion to $10.1 billion. Not only are more deals being done but also average deal size has increased.
This is likely because buyers are trying to catch up in the cyber security space with constantly evolving threats
and new technologies soon to be introduced such as 5G and IoT.
Particularly active sectors YTD include: cyber security consulting, access management, threat intelligence and
MSSP, among others.
Given the growing presence of cybersecurity risks, prospective buyers have evolved out of unrelated sectors.
Highlighting this trend in 2018 are Allstate, KPMG and TransUnion, who all pursued acquisitions of
cybersecurity companies for a combined valuation of ~$900 million. Within the cybersecurity industry, key
buyers include Splunk, Fortinet, and Palo Alto Networks.
$158
$1,653
$3,881
$2,910 $2,960
$480
$4,233
$4,775
$3,362
$4,143
$1,395
$2,260
$588
$6,304
$7,744
$6,349
$4,845
$1,445
$2,655
$11,419
$2,635
$2,454
$5,002
15
34
30
3432
35 36
32
4547 46
39
29
45
38
46
52
3942
45
58
43
38
Q1'13
Q2'13
Q3'13
Q4'13
Q1'14
Q2'14
Q3'14
Q4'14
Q1'15
Q2'15
Q3'15
Q4'15
Q1'16
Q2'16
Q3'16
Q4'16
Q1'17
Q2'17
Q3'17
Q4'17
Q1'18
Q2'18
Q3'18
Value ($M) Count
Viant Capital
San Francisco
Notable M&A Transactions – YTD October 2018
Source: Capital IQ, Press Releases 5
Buyer TargetDate Strategic Rationale
Jun 2018• “It is the perfect fit to reinforce our cybersecurity practice in North
America, to help meet the security requirements of our international
client base.”
• “TransUnion has long been at the forefront of developing innovative
fraud and identity solutions, and together with Iovation, we will create
an unmatched network of offline and online identities that will help
make transactions faster and more secure, while providing a frictionless
experience for consumers.”
May 2018
May 2018
• “Lumeta’s vendors pair well with FireMon’s vendor-agnostic approach
to solving customers’ problems. In addition, Lumeta’s history, which
dates back to the innovation center Bell Labs, perfectly complements
FireMon’s business model and technology strategy.”
Apr 2018
• “The deal combines the best public cloud infrastructure security
company, Evident.io, with the industry’s leader in public cloud
security, Palo Alto Networks. Together, our technologies will form the
world’s most advanced cloud security offering.”
Aug 2018• “By combining VictorOps' incident management capabilities and the
Splunk platform, organizations will be able to quickly resolve and even
help prevent issues that degrade customer engagement.”
Apr 2018
• “We see an opportunity to build upon Bomgar’s impressive technology
and enthusiastic customer base to rapidly expand their product
portfolio and market presence.”
Apr 2018
Mar 2018
• “We are excited to partner with SiteLock to support their continued
innovation of new products and solutions both organically and
inorganically.”
• “Phantom’s employees and technology significantly expand and
strengthen Splunk’s vision for the security nerve center and for
business revolution through IT.”
Aug 2018
Oct 2018
Oct 2018
Oct 2018• “As a new business unit within Cisco, Duo will benefit from being part
of a larger organization with established go-to-market reach, scale, and
partnerships. ”
• “We’re pleased to join the Fortinet team and bring together our shared
vision of alleviating CISO concerns about insider threat.”
• “Our relationships with top benefit brokers and over 1,000 companies
will be enhanced by Allstate’s capabilities and access to the Allstate
Benefits distribution network.”
• “We are excited to join Palo Alto Networks to bring together the
strength of our cloud analytics and their industry-leading compliance
technologies to help security teams protect their organizations.”
Jan 2018
• “Over the past ten years the ThreatMetrix team has pioneered the
digital identity space, and by combining the strength of LexisNexis
Risk Solutions and ThreatMetrix into a single business, our customers,
partners, and employees will benefit with a unique and compelling
market opportunity.”
Viant Capital
San Francisco
Notable Funding Activity – YTD October 2018
Sources: Capital IQ, Crunchbase, Momentum Cyber 6
$ in millions
Date Target InvestorsAmt
RaisedFunding Stage Industry Sub-Sector
Oct-25 Artic Wolf Future Fund 45.0 Series CNetwork & Infrastructure
Security
Oct-23 Area 1 Security Kleiner Perkins 32.0 Series C Threat Intelligence
Oct-22 Crisp Thinking Baird 25.0 Late Stage VC Digital Risk Management
Oct-17 White Source Susquehanna Growth 35.0 Series C Risk and Compliance
Oct-17 MSI BlueBear Capital 8..0 Series A Endpoint Security
Oct-10 Demisto Greylock Partners 43.0 Series C Incident Response
Oct-2 Tanium Wellington Management 200.0 Late Stage VC Information Technology
Jun-27 Social SafeGuard Allegis Cyber 11.0 Series B Digital Risk Management
Jun-27 Preempt Security Intel Capital 17.5 Series BSecOps & Incident
Response
Jun-27 Cynet Norwest Venture Partners 13.0 Series B Endpoint Security
Jun-27 Balbix, Inc. Singtel Innov8 20.0 Series B Risk and Compliance
Jun-23 IntSights Tola Capital 17.0 Series C Threat Intelligence
Jun-17 Tessian Accel Partners 9.0 Series A Messaging Security
Jun-12 Monarx, Inc. Kickstart Seed Fund 3.4 Seed Web Security
Jun-5 XAIN AG Earlybird Venture Capital 6.0 Seed Blockchain
Jun-4 Cyberbit Ltd. Claridge Israel 30.0 VentureNetwork & Infrastructure
Security
Jun-1 SafetoNet Ltd. West Hill Capital 13.0 Series AIdentity & Access
Management
May-30 Vulcan Cyber YL Ventures 4.0 SeedSecOps & Incident
Response
May-29 CyberSaint, Inc. BlueIO 3.0 Early Stage VC Risk & Compliance
Viant Capital
San Francisco
▪ The global MSSP market is projected to grow from
USD $24.1 billion in 2018 to USD $47.7 billion by 2023
(growing at CAGR of 14.7% from 2018 to 2023)
▪ Growth is projected to be driven by the rising number
of cyber attacks, increased complexities in network
infrastructure, and lack of capital resources and skilled
IT staff, all of which will require companies to rely on
MSSPs
Industry Perspectives – Managed Security Service Providers (MSSP)
Source: Allied Market Research, PR Newswire, Momentum Cyber 7
Transaction Activity
▪ YTD Q3 2018, 12 M&A transactions closed in the
MSSP space, compared to 26 total closed M&A
transactions for the space in 2017
▪ YTD Q3 2018, 6 financing transactions were completed
in the MSSP space, compared to 13 total financing
transactions for the space in 2017
▪ While transaction activity in the MSSP space has slowed
slightly in 2018, it still accounts for nearly 10% of all
cyber security M&A activity (based on # of deals) and is
expected to continue to do so
▪ Notable MSSP M&A transactions as of Q3 2018 include
ADT’s acquisition of Secure Designs, Capgemini’s
acquisition of Leidos and KPMG’s acquisition of Egyde
(all for undisclosed amounts)
▪ MSSPs have emerged as profitable options, as they help
businesses in protecting corporate online assets,
password files, sensitive e-mails, and networks. Thus,
MSSPs have been gaining acceptance among businesses
of all sizes as the businesses are significantly increasing
spending on network security.
▪ The increasing complexity of protecting infrastructure
against advanced cyber attacks will continue to compel
businesses to adopt or partner with managed security
services
▪ Strong governmental support is expected to be a critical
element in robust growth momentum of the MSSP
space
Recommendations and Outlook
Trends Representative Key Players
$24.1$27.6
$31.6$36.3
$41.6
$47.7
2018 2019 2020 2021 2022 2023
Forecasted Global MSSP Market Size
$ in billions
A Managed Service Security Provider (MSSP) is an IT service provider that offers cyber security
monitoring and management to companies.
Viant Capital
San Francisco
Industry Perspectives – Threat Intelligence
Source: SANS 2018 Cyber Threat Intelligence Survey, Center for Internet Security, Momentum Cyber,
Press Releases8
Trends
▪ Cyber threats are becoming the number one threat
facing businesses today, and threats are becoming more
advanced than ever. As such, cyber threat intelligence
(CTI) is also becoming increasingly important.
▪ SANS Institute published a report citing that 68% of
companies created or consumed CTI data in 2018, up
from 60% in 2017
▪ In 2018, dedicated threat intelligence platforms became
more common than in prior years. Previously, threat
intelligence feeds were often integrated via APIs
(application program interfaces). This suggests a
maturing in the space.
▪ 82% of organizations in the SANS survey reported using
third party sources for CTI data, such ISACs
(Information Sharing and Analysis Center) and CERTs
(Computer Emergency Response Team); suggesting that
information sharing is critical to the industry
Transaction Activity
▪ The broader threat intelligence/SOC/response sector
closed 19 M&A transactions YTD Q3 2018, compared
to 16 total closed M&A transactions for the space in
2017
▪ The broader threat intelligence/SOC/response sector
closed 36 financing transactions YTD Q3 2018,
compared to 52 total financing transactions for the
space in 2017
▪ Transaction activity in the threat intelligence space is
high as companies search for ways to effectively mitigate
cyber threats
▪ Notably, in July 2018, AT&T announced the acquisition
of AlienVault with an implied enterprise value of
$600M. AT&T hopes the acquisition will improve its
ability to help organizations detect and respond to cyber
security attacks.
Representative Key Players
▪ While CTI has come a long way, there still remains a
need for more integration between CTI tools and data
feeds, suggesting the need for more investment in the
space
▪ Organizations continue to face basic yet major
challenges when it comes to threat intelligence,
including: insufficient staffing, lack of budget and time
to deploy CTI
▪ CTI tools need to become easier to configure, integrate
and use, which will pave the way towards more
widespread use
▪ With continued threat advancement, companies will be
forced to dedicate more resources to CTI tools
▪ There is room for improvement and innovation in the
threat intelligence space; we expect to continue to see
strong investment and M&A activity
Recommendations and Outlook
Threat intelligence is data on cyber threats that has been collected, evaluated, and analyzed. To be
successful in identifying and mitigating threats, it requires collaboration from various sources.
Viant Capital
San Francisco
Industry Perspectives – Identity and Access Management (IAM)
Source: Wall Street Research, Gartner, Forrester Research 9
Trends
▪ By 2022, IAM as a service is projected be the chosen
delivery model for more than 80% of new access
management purchases globally, up from 50% as of 1H
of 2018
▪ The cloud-based security IAM market is poised to rise
from $2.5B in 2018 to over $3.4B by 2020
▪ Companies are seeking Identity-as-a-Service (IDaaS)
delivery models for new access management purchases,
forcing traditional providers of software and appliance-
based access management to switch to IDaaS offerings.
▪ The access management market is evolving to support a
variety of user authentication methods, adaptive access,
API target services, and mobile computing
▪ Increased number of identities from people and devices
is changing IAM architecture and making way for
decentralized identity services
Transaction Activity
▪ M&A activity in the IAM space is outpacing activity in
2017, with 25 transactions completed as of Q3 2018.
2017 saw 25 closed transactions. The high level of
activity reflects the consolidation taking place in this
space.
▪ Key M&A transaction in the IAM space as of Q3 2018
include the acquisition of Duo Security by Cisco (EV of
$2.4 billion), the acquisition of InfoArmor by Allstate
(EV of $525 million) and the acquisition of Centrify by
Thoma Bravo (EV of $500 million)
Representative Key Players
▪ Ongoing IAM provider consolidation is reshaping the
competitive landscape, making product positioning
pivotal. This also presents an opportunity for current
investors seeking to exit their investments.
▪ There is an increasing demand for smarter identity
analytics to detect threatening user behavior. Verticals
like Identity Analytics are growing to complement IAM
offerings. The possibility of integrating such
complementary offerings might drive IAM maturity in
the future.
▪ Blockchain-enabled identities and decentralized identity
are transforming IAM systems to allow users to create
and register their own identity and related relationship
identifiers, reducing costs. Gartner estimates
decentralized identity services will be ready for broad
production scenarios in 2020.
Recommendations and Outlook
IAM refers to a framework of policies & technologies to ensure that the right people have access to
the right resources. Traditionally implemented using on-premise solutions, IAM is moving towards
cloud based Identity-as-a-Service and hybrid offerings.
21
25 25
2016 2017 YTD 2018
IAM M&A Deal Volume
25
58
42
2016 2017 YTD 2018
IAM Financing Deal Volume
Viant Capital
San Francisco
10
This communication does not purport to be a complete statement of all material facts related to any company, industry, or security
mentioned. It is not a research report, as such term is defined by applicable law and regulations, and is provided for informational purposes
only. It is not to be construed as an offer to buy or sell or a solicitation of an offer to buy or sell any financial instruments or to participate in
any particular trading strategy. The information provided, while not guaranteed as to accuracy or completeness, has been obtained from
sources believed to be reliable. The opinions expressed reflect our judgment at this time and are subject to change without notice and may or
may not be updated. The financial instruments and companies discussed in this report may not be suitable for all investors, and investors
must make their own investment decisions using their own independent advisors as they believe necessary and based upon their specific
financial situations and investment objectives. Past performance should not be taken as an indication or guarantee of future performance, and
no representation or warranty, express or implied, is made regarding future performance. Securities offered through Viant Capital, LLC (A
FINRA registered broker-dealer).
